General

  • Target

    2360-3-0x00000000010D0000-0x0000000001579000-memory.dmp

  • Size

    4.7MB

  • Sample

    240924-rh95ba1gre

  • MD5

    d68f8bbf6ae3cb370bebb231fc7e2e33

  • SHA1

    cb18435a1a3dcaab67037b0f6f0e66ab480b08b7

  • SHA256

    152143b3f72124c782f767f0ca2dbd53822807b417f188143eb0117790ba9ddc

  • SHA512

    9c8c22f27259abbb5882e7e991fb5144ad0ee46a2c7f366d577027039891f82de848226d74812e9a6a207be074786b5b7cb0c78929505dcded4ae34d0a288621

  • SSDEEP

    98304:tg6OxFCnbkw81Vdg7Q8AX0PM24wlZXv6/HiWinMx3:t624eZXCHfiMx3

Score
10/10

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Targets

    • Target

      2360-3-0x00000000010D0000-0x0000000001579000-memory.dmp

    • Size

      4.7MB

    • MD5

      d68f8bbf6ae3cb370bebb231fc7e2e33

    • SHA1

      cb18435a1a3dcaab67037b0f6f0e66ab480b08b7

    • SHA256

      152143b3f72124c782f767f0ca2dbd53822807b417f188143eb0117790ba9ddc

    • SHA512

      9c8c22f27259abbb5882e7e991fb5144ad0ee46a2c7f366d577027039891f82de848226d74812e9a6a207be074786b5b7cb0c78929505dcded4ae34d0a288621

    • SSDEEP

      98304:tg6OxFCnbkw81Vdg7Q8AX0PM24wlZXv6/HiWinMx3:t624eZXCHfiMx3

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

MITRE ATT&CK Matrix

Tasks